How to: Limit access to data in table by field?

[Former Member]

Hi,

Is there a way that our basis team can block access to data within a table based on a field variable without blocking access to the data in that table?

e.g. Only return to Gavin financial data relating to company code 9000

My colleague and I have asked our basis team for access to SQVI - however they do not want to grant us access to SQVI unless they can prevent us looking at the data within the table's that do not relate to our company (financial data limited to a single company code).

Kind regards and many thanks,

Gavin

<i>PS - this is my first post :)</i>

[RainerKunert]

Hi Gavin,

for some tables the access can be limited with authorization object S_TABU_LIN. But S_TABU_LIN must be activated first in customizing. It may have any impact on performance.

I think your authorization administration will have a problem with activating S_TABU_LIN, because the already designed roles must be adapted.

Kind regards

Rainer

[WolfgangJanzen]

I'd define a (DB) view and use the selection conditions to restrict the access (capabilities).

Cheers, Wolfgang

[Former Member]

Rainer -

I have looked into some of the online help with this and I agree that adapting an already pre-defined role may indeed cause problems. We access our SAP server over a VPN too, so our perfomance is already poor as it is

Wolfgang -

Whilst using the SQVI module, we can prototype reports in the live system by querying the different tables - will a "Database View" in SAP allow me access to a table but only, for example, for data relating to my company code?

<u>In otherwords - could my basis team give me access to Database Views instead of tables in my user profile - and use those Database views to restrict what data I can see from certain tables?</u>

Thanks you to you both,

Gavin

[WolfgangJanzen]

> <u>In otherwords - could my basis team give me access

> to Database Views instead of tables in my user

> profile - and use those Database views to restrict

> what data I can see from certain tables?</u>

Yes. For Database Views you can define constraints (like "company code = 9000") using <b>selection conditions</b>. Use transaction SE11 to define such views.

Regards, Wolfgang

[Former Member]

And I am I right in thinking that once the Database Views have been created - the basis team can then assign my user profile to have access to those Database Views instead of the tables that contain the information that they do not want me to see?

Kind Regards,

Gavin

[WolfgangJanzen]

Yes, S_TABU_DIS does control both, tables and views.

Consequently, the users should be only granted access for the view but not for the table. The view constraints ensure that only selected parts of the table are accessible.

Regards, Wolfgang

[Former Member]

Thank you very much Wolfgang.

I will pass this solution onto the basis team and hopefully I'll get my SQVI access shortly

Best wishes,

Gavin